iis security: IIS6 ASP and com socket security(?) problem -- iis security

Re: IIS6 ASP and com socket security(?) problem

ofer NO[at]SPAM intelligate.com
3/2/2004 4:41:50 AM

Thank you for the prompt response.

I ran some tests, as you described and found out the following:

1. A vb application running under loacl administrator succeeds in the
object creation, and in calling the function that creates the socket,
and communication wokrs fine.

2. The asp page using the "network service" and local IUSR succeeds in
object cration, but fails in the function call that create the socket.

3. Denying the local IUSR from accessing the dll that runs the com
object results in a failure in the asp page creating the object.

4. Explicitly allowing the IUSR access to the dll (no matter what
application pool account) - fails again as in test #2.

What next?

Thanks,

Ofer.

[quoted text, click to view]

Re: IIS6 ASP and com socket security(?) problem

v-wzhang NO[at]SPAM online.microsoft.com (
3/3/2004 6:25:59 AM

Hello Ofer,

I wonder what the detailed error message was in IE? Please make sure
'Show friendly HTTP error message' has been disabled in IE Internet
options->Advanced.

Also, as I suggested in the previous thread, have you tested the page
with integrated windows auth? We should confirm at least the page can
work with administrator account's permission.

For further troubleshooting, you can enable security auditting to see
if it is able to log some detailed permission denied events of this
error. To do this, go to administrative tools->Local Security
Settings->Local Policies->Audit Policy, enable all kinds of failure
audits. Then open event viewer, clear and save as current Security
log. Browse to the page to reproduce the error, refresh the security
log to check if there is any failed events.

You can also enable auditting for specific files or folders, FYI:
300958 HOW TO: Monitor for Unauthorized User Access in Windows 2000
http://support.microsoft.com/?id=300958

301640 HOW TO: Set, View, Change, or Remove Auditing for a File or
Folder in
http://support.microsoft.com/?id=301640

Looking forward to your results.
Have a nice day,

WenJun Zhang
Microsoft Online Support
This posting is provided "AS IS" with no warranties, and confers no
rights.
Get Secure! - www.microsoft.com/security

Re: IIS6 ASP and com socket security(?) problem

v-wzhang NO[at]SPAM online.microsoft.com (
3/4/2004 5:49:10 AM

Hello Ofer,

Any progress or findings on this issue?

Have a nice day,

WenJun Zhang
Microsoft Online Support
This posting is provided "AS IS" with no warranties, and confers no
rights.
Get Secure! - www.microsoft.com/security

Re: IIS6 ASP and com socket security(?) problem

ofer NO[at]SPAM intelligate.com
3/7/2004 12:19:44 AM

Hello WenJun

The problem was not solved, but a workaround solution has been found.

Instead of using regsvr32 to register the dll, we defined the dll as a
com+ application.

The strange thing is that we used the IIS user as the "Identity" for
this com+ application, and cancelled the access check (under Security
tab) and the object could be called from the .asp page, without any
changes to the dll's permissions.

To sum up:
From a vb application, the registered dll worked fine.
From an asp page - the object was created ok, but through an exception
when created a socket.
From an asp page useing the com+ workarund, using the IIS user as its
identity - the object worked fine.

Maybe it is not a security issue, but rather a bug related somehow to
security and identities.

Notice that there are some more resources over the net talking about
the same or similar problem, when trying to create a socket, moving
from IIS5 to IIS6.

Thanks again,

Re: IIS6 ASP and com socket security(?) problem

v-wzhang NO[at]SPAM online.microsoft.com (
3/8/2004 9:27:32 AM

Hmm.. wrapping the dll into a COM+ package and disable access check,
sounds a smart workaround, thanks for inform me of this. :-)

Please don't hesitate to post here if you meet other IIS issues in
futher. I'm pleased to discuss them with you.
Best regards,

WenJun Zhang
Microsoft Online Support
This posting is provided "AS IS" with no warranties, and confers no
rights.
Get Secure! - www.microsoft.com/security

Re: IIS6 ASP and com socket security(?) problem

ofer NO[at]SPAM intelligate.com
3/29/2004 4:59:36 AM

see

http://groups.google.com/groups?hl=en&lr=lang_en|lang_iw&ie=UTF-8&oe=UTF-8&safe=off&frame=right&th=6b1986c8cd600446&seekm=956fdc35.0401180906.147c6e2c%40posting.google.com#link8

Re: IIS6 ASP and com socket security(?) problem

v-wzhang NO[at]SPAM online.microsoft.com (
3/30/2004 1:39:16 AM

Thanks for the details Ofer. Now the issue is quite clear to me as
well. :-)
And I'd mention the solution you found: Wrapping COM dll to COM+ to
specify a running identifier is a very useful and familiar way to
work around component permission issues in ASP.

Hope you have a nice week.

Best regards,

WenJun Zhang
Microsoft Online Support
This posting is provided "AS IS" with no warranties, and confers no
rights.
Get Secure! - www.microsoft.com/security

Re: IIS6 ASP and com socket security(?) problem

thodgson NO[at]SPAM gmail.com
1/19/2005 5:26:10 PM

I encountered a similar problem calling a COM object from ASP. The
object contains a call to CSocket::Create, which would throw an
exception.

By simply setting the password of the IUSR_MACHINENAME to something
different, everything worked again.

[quoted text, click to view]

Got something to say? Click here to post a reply to this thread.

Don't see what you're looking for? Try a search.

View other messages in the iis security group.